loneloader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loneloader.exe
Size 388KB
Sample260803-wqvrtavdqa
SHA256 bd16c07a1b459e7e43e6e30ea410ac1376d58753915a1b161b364f1ea029a7c5
MD5 060450df093b244ed20c3853901413c9
SHA1 f04a36d031af33e978322fa5ca19659b4941af18
SHA512 05dffba80f7bbe1c06c7092278eea50f849d8b3b4f08f7022ba15a459bea1fe12657974f58dc01334ac26b2a54c08c8eef5983bd441a32a4336404ec31287bda
SSDEEP 12288:Tj5mYQMOWAE9QmQLlGvnPSBm9iMeP/Z5VZIb39b8b0QxbDjBPrbDbhmb4GbD2P/d:5RQMO9yVQYvnP
TLSH
T19D846C16EBA505FCE0A7A17889B65903F336B84F03918FDF27D441A62F536D09E3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loneloader.exe

File Explorer

loneloader.exe

.exe 388KB

loneloader.exe

IMPHASH 78f519f0087cece40e4b6cf991549412
SHA256 bd16c07a1b459e7e43e6e30ea410ac1376d58753915a1b161b364f1ea029a7c5
MD5 060450df093b244ed20c3853901413c9
SHA1 f04a36d031af33e978322fa5ca19659b4941af18
SHA512 05dffba80f7bbe1c06c7092278eea50f849d8b3b4f08f7022ba15a459bea1fe12657974f58dc01334ac26b2a54c08c8eef5983bd441a32a4336404ec31287bda
SSDEEP 12288:Tj5mYQMOWAE9QmQLlGvnPSBm9iMeP/Z5VZIb39b8b0QxbDjBPrbDbhmb4GbD2P/d:5RQMO9yVQYvnP
TLSH
T19D846C16EBA505FCE0A7A17889B65903F336B84F03918FDF27D441A62F536D09E3A760
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

148572

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmSetWindowAttribute

winhttp

WinHttpSendRequest WinHttpSetTimeouts WinHttpCloseHandle WinHttpConnect WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpWriteData

wininet

InternetOpenW InternetQueryDataAvailable HttpOpenRequestW HttpQueryInfoW HttpSendRequestW InternetConnectW InternetSetOptionW InternetReadFile InternetCloseHandle

bcrypt

BCryptGenRandom

crypt32

CryptProtectData CryptUnprotectData

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW

kernel32

LCMapStringW VirtualProtect MultiByteToWideChar Sleep GetLastError QueryPerformanceFrequency LoadLibraryW GetProcAddress FreeLibrary QueryPerformanceCounter GetCurrentProcess WriteFile GetTempPathW WaitForSingleObject CreateFileW GetFileAttributesW CreateToolhelp32Snapshot GetTickCount64 Process32NextW DeleteFileW Process32FirstW CloseHandle CreateThread MoveFileExW GetCurrentProcessId WideCharToMultiByte GetTickCount DeviceIoControl SetEnvironmentVariableA ReadFile GetFileSizeEx GetModuleFileNameW TerminateProcess GetCurrentThread GetThreadContext GetModuleHandleW IsDebuggerPresent CheckRemoteDebuggerPresent LocalFree SetFileAttributesW OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree LoadLibraryExW FindFirstFileW FindNextFileW FindClose LocalAlloc GetEnvironmentVariableW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc WriteConsoleW SetFilePointerEx RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent

user32

GetClientRect PostMessageW SendMessageW ExitWindowsEx ReleaseCapture DefWindowProcW DestroyWindow MessageBoxW CreateWindowExW UpdateWindow UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW TranslateMessage LoadCursorW PostQuitMessage GetSystemMetrics

gdi32

GetStockObject

advapi32

RegCreateKeyExW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation RegGetValueW EventUnregister EventWriteTransfer EventSetInformation EventRegister RegQueryValueExA RegCreateKeyExA RegSetValueExA RegCloseKey RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW CryptAcquireContextW CryptGenRandom CryptReleaseContext LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteExW

ole32

CoTaskMemFree CoInitializeEx CoUninitialize

Name

.text

Size

249KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loneloader.exe

dwmapi

winhttp

wininet

bcrypt

crypt32

setupapi

kernel32

user32

gdi32

advapi32

shell32

ole32

generic